Privacy Policy

Comix turns one photograph into a personalised comic. That photograph is the most sensitive thing you will ever give us, and it is treated accordingly.

The rest of this page is the detail behind those promises: exactly what we hold, on what legal basis, for how long, and who else touches it — including the advertising measurement we use on our marketing, sign-up and checkout pages.

Comix is operated by Artemius Labs LLC, 1021 E Lincolnway #10375, Cheyenne, WY 82001, United States. Artemius Labs LLC is the data controller for the personal data described here. Write to support@artemius-labs.com for any privacy question, request, or complaint. We answer within thirty (30) days, and sooner where the law requires it.

This policy covers mycomicstory.com and the Comix web application. It does not cover third-party sites you reach from a link we publish.

Account data

Email address, display name, password hash, and — if you sign in with Google — the Google account identifier, email, and name released by that sign-in.

Child and book data

The photograph you upload (downscaled on your device to at most 420 pixels before it is sent), the child's first name or nickname, the chosen occasion or your own story idea (up to 280 characters), the comic style, your answers to the optional while-you-wait questions (story preferences such as the tone you like and topics to keep out, chosen from fixed options), the generated story text and illustrations, any edits you make, whether a share link is switched on, and the time you confirmed parental consent.

Subscription data

Plan, billing interval, subscription status, and renewal dates. Card details are handled by Stripe and never reach our servers.

Order data

For printed comics: recipient name, shipping address, phone number and email (passed to the printer and the carrier), quantity, gift note, and order status. For a pre-order reservation: the email and country you give.

Technical data

IP address, device and browser type, timestamps, pages viewed, and generation events — used for security, rate limiting, abuse prevention, and diagnosing failures.

Product analytics data

With your consent: which pages and steps of the Service you reach, which of our own options you choose (a style, a plan), errors your browser runs into, and — on our marketing, sign-up, log-in, checkout and legal pages only — a recording of how the page is used, with everything typed into a field masked. Collected for us by PostHog, tied to your account’s ID and plan, never to your name or email. Never recorded or captured automatically: the comic builder, your bookshelf, your account, and any comic — so never a child’s name, photograph or story.

Advertising data

Meta cookies set by the Meta Pixel on our marketing, sign-up and checkout pages, and the event data we send to Meta described in section 8.

Support data

The content of emails and messages you send us, and our replies.

We use Meta advertising measurement as set out in section 8. We do not sell personal data, and we do not buy personal data from brokers.

A book is about a child, so a book contains a child’s personal data — a facial image, a first name, and the story preferences you choose. We treat this as the most protected category we hold.

• Comix is used by parents and guardians. Accounts are for adults aged 18 or over, and children do not create accounts.
• Before a child’s photo can be used, the person uploading it must tick a box confirming they are the child’s parent or legal guardian, or have the parent or guardian’s permission, and agreeing to the photo being used to create the comic. We store the time of that confirmation with the book.
• The photograph is processed to generate the artwork for your book and for nothing else — no facial-recognition database, no biometric identity matching, no advertising, no training. Photos, children’s names and comic content are never sent to Meta.
• Books are private by default: only you, signed in to your account, can open them. Our staff can open a book only for a stated reason — you asked us for help with it, we are investigating a report of misuse or a failed generation, or we are checking a small sample of finished comics to make sure generation is safe and works as it should. Staff see the finished comic, never the original photograph, and every such access is recorded with who opened it, when and why. On the Family plan and above you can create a share link. Anyone with that link can read the finished comic — but never the original photo or your story preferences — and turning the link off stops it working immediately.
• Children cannot register, and we do not knowingly collect data directly from a child.
• If we learn that a child created an account, or that a photograph was uploaded without guardian consent, we delete the account and its content promptly.

A guardian may ask us at support@artemius-labs.com what we hold about their child and require its deletion, whether or not they hold the account it sits under.

To provide the Service

Generating, storing, editing, previewing, downloading, and — when you turn on a share link — sharing your books. Basis: performance of our contract with you.

To process a photograph

Creating an illustrated likeness from the image you upload. Basis: your explicit consent, given when you tick the consent box at upload and withdrawable at any time by deleting the book, together with performance of our contract with you.

To take payment

Subscriptions, renewals, print orders, and fraud checks. Basis: contract, and our legal obligations on tax and accounting.

To keep the Service safe

Automated moderation of free-text inputs, rate limiting, bot protection on sign-up, abuse detection, and incident investigation. Basis: our legitimate interest in a service that is not misused, and the protection of children.

To understand and improve the Service

Product analytics and session replay through PostHog, as described in sections 3 and 13: finding where people get stuck, and fixing faults. Basis: in the EEA, the UK and Switzerland, your consent, given in our cookie banner and withdrawable at any time with Privacy choices in the footer; elsewhere, our legitimate interest in a service that works, which you can object to at any time the same way.

To measure our advertising

Measuring and optimising our ads on Meta with the Meta Pixel and Conversions API, as described in section 8. Basis: in the EEA, the UK and Switzerland, your consent, given in our cookie banner and withdrawable at any time with Privacy choices in the footer; elsewhere, our legitimate interest in knowing which ads work, which you can object to at any time the same way.

To support and inform you

Answering messages and sending service notices such as billing notices and policy changes. Basis: contract and legitimate interest.

To comply with law

Retaining records, answering lawful requests, and reporting illegal material. Basis: legal obligation.

Marketing email is opt-in — a box you tick when signing up — and every such email has an unsubscribe link. Service and billing notices are not marketing and cannot be switched off while you hold an account.

To write and illustrate a comic we send OpenAI, acting as our service provider, only the inputs it needs: the photograph, the child’s first name, the chosen occasion or your own story idea (up to 280 characters), and your story preferences. We also send the finished pages back to a vision model, which reads the lettering to check that every line is there and spelled as written; a page that fails is drawn again.

• OpenAI processes this data to fulfil our requests. The photograph is sent solely so the illustrations can be drawn.
• Your inputs and outputs are not used to train models. Under OpenAI’s API data policy, data sent through its API is not used to train its models, and we never use your photos to train models either.
• Providers may hold transient copies for a short abuse-monitoring window, after which they are deleted on their side.
• Free-text inputs are length-limited and checked by OpenAI’s automated moderation before a story is written. Requests flagged as unsafe are refused. Moderation is automated: no person reads what you type before your story is written. Afterwards, staff may open a finished comic only for the recorded reasons set out under “Children’s data” above.
• Generation is automated, but it produces a book, not a decision about you. No processing we carry out has a legal or similarly significant effect on you.

Stories are written under rules that require gentle, age-appropriate content, but AI output can occasionally be imperfect. You can delete a book at any time or make a new one within your plan’s allowance, and you can report a problem to support@artemius-labs.com. If a request you believe was legitimate is refused by moderation, try rewording it or write to us at the same address.

We share personal data only with providers who need it to run the Service, and only for that purpose:

Supabase

Database, authentication, and file storage — accounts, books, photographs, illustrations, and orders.

Vercel

Hosting and delivery of the website and web application.

OpenAI

Writing the story, drawing the illustrations, and automated moderation of free-text inputs.

Replicate

Image analysis during internal testing by our own staff only. Customers’ comics are not sent to it.

Loops

Email: account messages (confirming your address, resetting a password, telling you a comic is ready, receipts-related notices) and, only if you opted in, marketing email. Receives your email address, first name, plan, how you signed up, and — to tell you a comic is ready — its title and the child’s first name. Never the photograph or the comic itself. Your contact there is deleted when you delete your account.

Stripe

Payments, subscriptions, and the billing portal. Card details go straight to Stripe and never reach our servers.

Google

Optional “Sign in with Google”, only if you choose to use it.

Cloudflare

Turnstile bot protection on the sign-up form.

PostHog

Product analytics and session replay, with your consent. Receives page and step events, your account’s ID and plan, technical data about your browser, and masked recordings of our marketing, sign-up, log-in, checkout and legal pages. Never the builder, a comic, a photograph, a child’s name or a story.

Meta Platforms

Advertising measurement through the Meta Pixel and Conversions API, as described in section 8.

Print and delivery

Print partners and carriers, which receive the comic file, the recipient's name, shipping address, phone number and email for an order you place.

We also disclose data where we must: to comply with a valid legal request, to enforce our Terms, to protect the rights and safety of a child or any person, or as part of a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.

We do not sell personal data.

We advertise Comix on Meta’s platforms and use two Meta tools to measure and optimise those ads:

Meta Pixel

Runs on our marketing, sign-up, and checkout pages — never on comic or book pages — and sets Meta cookies such as _fbp and _fbc.

Meta Conversions API

From our servers we send Meta a SHA-256 hash of your email address, your account ID, your IP address, your browser user agent, and the name of the event — viewing the plans, sign-up, checkout started, or purchase. So that a purchase completed on Stripe's page can still be reported, the Meta browser identifiers (the _fbp and _fbc values), your IP address and user agent are also stored with your subscription record at Stripe.

Never sent to Meta

Photos, children's names, and comic content.

In the EEA, the UK and Switzerland, none of this happens unless you accept advertising cookies in our cookie banner: until then the Meta Pixel does not load and we send nothing about you to Meta through the Conversions API. If you decline, the same applies to a purchase you make.

Wherever you are, you can limit or stop this:

• choose Privacy choices in the footer of our site and decline advertising cookies — this stops the Pixel, clears the Meta cookies it set and stops our Conversions API events about you;
• turn on Global Privacy Control in your browser — we treat that signal as declining;
• block or clear Meta cookies in your browser’s cookie settings;
• use an ad blocker or tracking blocker;
• adjust your ad settings with Meta at facebook.com/adpreferences;
• write to support@artemius-labs.com to object to this processing.

Artemius Labs LLC is based in the United States and our providers operate globally, so your data is processed in the United States and may be processed outside your country. Where data leaves the European Economic Area or the United Kingdom, we rely on adequacy decisions or on Standard Contractual Clauses together with the additional safeguards those clauses require. Write to support@artemius-labs.com for details of the mechanism used for a particular provider.

Books, photographs, illustrations, story text

Until you delete the book or your account. Deletion is permanent and immediate.

Deleted items in backups

Copies can remain in our providers' encrypted backups for up to thirty (30) days before they are purged.

What outlives a deleted account

Three things, none of which can identify a child: a one-way hash of your email address, kept so that the free comic cannot be claimed again by deleting an account and re-registering; the record of payments and refunds, without your name, for our accounts; and the lines of our staff access log (who opened a comic, when and why), from which the comic’s title and any note are erased.

Account and profile

Until you delete your account in Settings, when it is deleted immediately (subject to the backup period above). Technical usage counts — how many images and words were generated — are kept under an internal identifier that no longer points to anyone once the account is gone.

Print order records

Kept while your account exists, so we can fulfil and support the order, and deleted with your account.

Payment and invoice records

Held by Stripe for the periods tax and accounting law require; deleting your Comix account does not remove them.

Technical and security logs

Up to twelve (12) months, then deleted or aggregated beyond identification.

Support correspondence

Twenty-four (24) months from the last message.

Where we must keep a record for legal reasons, we keep the minimum needed and stop using it for anything else.

• The child’s photo is downscaled on your device to at most 420 pixels before upload, so we never receive a full-resolution original.
• Encryption in transit (HTTPS), and encryption at rest provided by our hosting providers.
• Illustrations are kept in private storage and delivered to your browser only through signed links that expire after two hours.
• Database row-level security, so a signed-in account can reach its own books and nothing else. Books are private by default, and share links use a secret random token that you can switch off.
• Rate limits on sign-up, story generation, drawing, and PDF downloads, and bot protection on sign-up.
• Security headers, including a Content-Security-Policy.
• Passwords are stored only as salted hashes by our authentication provider; we never see your password.

No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the competent supervisory authority within the deadlines the law sets — for the GDPR, seventy-two (72) hours from becoming aware of it.

Depending on where you live, you have the right to:

• access the personal data we hold about you and your child;
• correct anything inaccurate;
• delete your data — including every photograph and every book;
• receive a copy of your data in a portable format;
• object to, or ask us to restrict, processing based on legitimate interests, including advertising measurement;
• withdraw consent to photo processing at any time, without affecting past processing;
• complain to your data protection authority.

Much of this is self-service: download any book as a PDF, delete any book from your library, turn off a share link, or use Settings → Delete my account and all photos to permanently delete your account, every book, photo and illustration, the print order records we hold, and your profile. There is no one-click export of a whole account — for access to, or a copy of, everything we hold, write to support@artemius-labs.com.

1. 1Send your request from the email address on the account, or tell us how else to reach you.
2. 2We verify that the request really comes from the account holder or the child's guardian — a proportionate check, never a demand for identity documents unless the request itself makes that necessary.
3. 3We answer within thirty (30) days, and tell you if a complex request needs longer.

We keep this deliberately small.

Essential

Session and authentication cookies that keep you signed in and protect against request forgery; Cloudflare Turnstile’s bot check on the sign-up form; and one cookie, cmx_ads, that remembers your choice about advertising cookies for six months. These are needed to run the Service and are not used for advertising.

Analytics

PostHog’s cookie and local-storage entries (names beginning ph_), which tell one visit from another so we can see where people get stuck. Set only under the same choice as advertising cookies below, and removed from use the moment you decline. No recording and no automatic capture ever runs in the comic builder, on your bookshelf or account, or on any comic.

Advertising

Meta Pixel cookies such as _fbp and _fbc, set on our marketing, sign-up, and checkout pages only — never on comic or book pages — to measure and optimise our ads. In the EEA, the UK and Switzerland they are set only after you accept them in our cookie banner. Elsewhere they are on unless you decline or your browser sends Global Privacy Control. See section 8.

You can change your choice at any time with Privacy choices in the footer of our site, or right here. Clearing cookies in your browser signs you out and, where it applies, shows the cookie banner again.

Privacy choices

EEA and UK. The legal bases are listed in section 5. You may complain to your national supervisory authority, or to the Information Commissioner’s Office in the UK.

California. You may request the categories and specific pieces of personal information we collected, request deletion, and request correction. We do not sell personal information. Our use of Meta advertising measurement (section 8) may count as “sharing” for cross-context behavioural advertising under the CCPA/CPRA; you can opt out by writing to support@artemius-labs.com and by using the controls described in section 8. We do not discriminate against anyone who exercises a right.

United States — children. Comix is directed at parents and guardians, not at children, and children do not create accounts. Where a book contains a child’s data, it is uploaded and controlled by the adult who holds the account, who may review and delete it at any time.

We update this policy as the Service changes. The version line at the end of this page always identifies the current version, and material changes are announced by email or in-app at least thirty (30) days before they take effect. Continued use after that date is acceptance of the updated policy.